Digital content or digital services are often supplied also where the consumer does not pay a price but provides personal data to the trader. Such business models are used in different forms in a considerable part of the market. While the current law fully recognises that the protection of personal data is a fundamental right and that therefore personal data cannot be considered as a commodity, it is important to respect that consumers are, in the context of such business models, entitled to contractual remedies.
In general
Payment by personal data, as a relatively new term, is gradually beginning to appear and enshrined in legislation as could be seen in the beginning of this year with the adoption of Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 (hereinafter “Accompanying Directive“), which amended four existing EU consumer directives, including Directive 2011/83/EU on consumer rights (hereinafter “Directive 2011/83“), which, inter alia, regulates and takes into account situations where the consumer pays or undertakes to pay money, as well as those where the consumer provides or undertakes to provide the trader with his personal data for a particular service.
The Accompanying Directive has ensured consistency with, inter alia, Directive (EU) 2019/770 of the European Parliament and of the Council of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services (hereinafter “Directive 2019/770”), which also applies to contracts under which the provider provides or undertakes to provide digital content or a digital service to the consumer and the consumer provides or undertakes to provide personal data.
Personal data in the lead role
Directive 2011/83 and Directive 2019/770 apply to contracts for the provision of digital services and digital content which is not provided on a tangible medium (i.e. the provision of digital content online), regardless of whether the consumer pays in money or provides personal data.
Given that in both cases a contractual relationship is established, the Accompanying Directive explicitly applies to the “payment” by personal data all legal consequences arising from Directive 2011/83 and Directive 2019/770.
At this point, the so-called Accompanying Directive comes into play, the Accompanying Directive ensures the desired consistency between the scope of Directive 2011/83 and Directive 2019/770, which applies to contracts for the provision of digital content or digital services under which the consumer provides or undertakes to provide to the trader his personal data.
And where did the GDPR disappear?
However, all processing of consumer personal data should continue to be carried out by the trader in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter “GDPR”).
The directives are without prejudice to the rights of consumers as data subjects, which apply to all personal data provided by the consumer to the trader or collected by the trader in connection with the contract and at the time the consumer terminates the contract in accordance with the directives.
The directives should also be without prejudice to the rights, obligations and non-contractual remedies provided for in the GDPR. In the event of a conflict between directives and EU legislation on personal data protection, EU legislation on personal data protection shall prevail.
Scope of the Directive 2011/83
As in the case of contracts for the supply of digital content, which is not provided on a tangible medium, Directive 2011/83 should apply whenever the consumer provides or undertakes to provide personal data to the trader, except if:
- personal data provided by the consumer are processed exclusively by the trader for the purpose of providing digital content or digital services and the trader does not process this data for any other purposes;
- the trader collects personal data exclusively for the purpose of complying with the legal requirements that apply to him (e.g. the necessary registration of the consumer to ensure security and identification),
- the trader only collects metadata, such as information concerning the consumer’s device or browsing history (i.e. cookies), except where this situation is considered as a contract under national law.
The trader should refrain from using any content other than personal data provided or created by the consumer when using digital content or a digital service provided by the trader, except where such content:
- cannot be used outside of digital content or digital services provided by the merchant; relates only to the consumer’s activity when using the digital content or digital service provided by the trader;
- was merged with other data by the trader and cannot be, or can be only with disproportionate effort, separated;
- was created by the consumer together with other persons, and other consumers may continue to use this content.
Except for the situations in (i), (ii) and (iii), the trader shall ensure to the consumer, at his own request, the availability of any content other than personal data, which was provided or created by the consumer when using digital content or digital services provided by the trader. The consumer shall be entitled to recover the said digital content free of charge, without obstacle on the part of the trader, within a reasonable time and in a commonly used machine-readable format.
Scope of the Directive 2019/770
EU legislation on personal data protection provides a complete list of legal grounds for the lawful processing of personal data. Directive 2019/770 thus does not regulate the conditions for the lawful processing of personal data since this issue is regulated in particular in the GDPR.
Consequently, any processing of personal data in connection with a contract falling within the scope of this Directive 2019/770 is lawful only if it complies with the provisions of the GDPR relating to the legal grounds for the processing of personal data. It should be used, for example, in cases where a consumer sets up an account on a social network and provides his name and e-mail address, which are used for purposes other than the exclusive provision of digital content or digital services or for purposes other than complying with legal requirements. It should also apply to cases where the consumer consents to the trader processing materials representing personal data, such as photographs or messages uploaded by the consumer, for marketing purposes.
If digital content and digital services are not provided for remuneration, this Directive 2019/770 should not apply to situations where the trader collects personal data exclusively for the purpose of providing digital content or digital services or exclusively for the purpose of complying with legal requirements (e.g. the necessary registration of the consumer in order to ensure security and identification in accordance with applicable regulations), while the trader does not process this data for any other purpose. It should also not apply to situations where the trader merely collects metadata, such as information concerning the consumer’s device or browsing history, except where this situation is considered as a contract under national law. Nor should it apply to situations where the consumer is exposed to an advertisement solely for the purpose of gaining access to digital content or digital services without concluding a contract with the trader.
Payment by personal data – termination of the contract
The Directives are without prejudice to the rights of consumers as data subjects, which apply to all personal data provided by the consumer to the trader or collected by the trader in connection with the contract and at the time the consumer terminates the contract in accordance with the directives.
If the digital content or digital service is not provided for remuneration but the consumer provides personal data, the consumer should be entitled to terminate the contract in cases where non-compliance with the contract is insignificant because the consumer does not have a remedy for reducing the price. In cases where the consumer pays the price and at the same time provides personal data, he should have the right to exercise all available remedies in the event of non-compliance.
Upon termination of the contract, the trader should refrain from using any content other than personal data provided or created by the consumer when using the digital content or digital service provided by the trader. This content could include digital images, video and audio files, and content created on mobile devices.
However, the trader should have the right to continue to use content provided or created by the consumer in cases where this content cannot be used outside of digital content or digital services provided by the trader, this content is only related to the consumer’s activities, it has been merged with other data by the trader and it cannot be, or only with disproportionate effort, separated or created by the consumer together with other persons and other consumers may continue to use it.
Conclusion
Nowadays, when personal data are more valuable than ever, it is all the more necessary to clearly define the rules for the use of consumer personal data, which reach the trader in the form of consideration for digital services.
For that reason, the scope of Directive 2011/83 has been adjusted to cover contracts where the consumer provides or undertakes to provide personal data to the trader. Amendments of this nature have been adopted in the light of the Accompanying Directive, which, once transposed by the Member States by 28 November 2021, will bring greater protection, transparency, and more rights to consumers.
Tereza Pšenčíková, LL.B., LL.M., junior lawyer – psencikova@plegal.cz
Mgr. Jakub Málek, partner – malek@plega.cz
29.07.2020